RIP Adobe Flash Player – What about my GRC Dashboards?

Adobe has officially announced the end of life of Flash Player, the web browser plug-in heavily used in the past by many web sites for displaying rich content.  Probably, the beginning of the end was back in 2010 when Apple decided not to support the plug-in on their iPhones and iPads due to security vulnerabilities it posed.

The way forward is to make use of HTML5 capabilities to display the dynamic content, a much better and secure alternative.

In SAP GRC there are several dashboards based on Adobe Flash player that must be migrated accordingly. Few SAP notes and information materials have been released recently to help customers with the transition to either Fiori or IGS (Internet Graphic Server) based solution.

SAP made available two options to the customers as follows (SAP Notes: 2947941 – Information related to GRC Dashboards and Adobe Flash): While the majority of related notes are covering Access Control reporting, we would like to emphasize the handling of dashboards in Risk Management and Process Control:

  • FIORI Overview Pages (OVP) – recommended:
    • KPI Style dashboards with enhanced look and feel based on Fiori.
    • Fiori OVP card are not a one-to-one replica of the existing reports.
    • Requirements:
      • SAP GRC 12 SP11
      • UI Components: UIGRPC01, UIGRAC01, UIGRRM01, UIGRRMPC (SP04). Please note that if your SP level is lower than 11, you need to apply notes with those components separately.
      • Fiori Launchpad activation, new roles, etc.
  • Main Note for Process Control is 3006402 – (Knowledge-based article) GRC-PC Process Control Overview pages (FIORI Dashboards).
    • Core Notes PC 12 Service Pack 11. For component GRCCFND_A (Backend)
      • 2940631 – CDS and ODATA for Fiori Dashboard applications
      • 2982742 – Timeframe UI for Process Control Dashboard
    • For component UIGRRMPC (Frontend Fiori ALP): 2983756 – Fiori PC Dashboard Tile Catalog.
    • Applications to be delivered:
      • 2982595 – Issue Summary Dashboard Analytical List Page application
      • 2983150 – Survey Assessment Summary Dashboard Analytical List Page application
      • 2983759 – BSP Application for test summary
      • 2983543 – Risk Coverage Summary Dashboard
      • 2983824 – Fiori Remediation Plan Summary Dashboard – Initial Development
      • 2983961 – Signoff Summary Dashboard Analytical List Page application
  • Internet Graphic Server (IGS) based solution:
    • Recommended for customer using SAP GRC 12 below SP06  (GRC 10 and 10.1 included) or not using FIORI apps.
    • Flash dashboards will be converted to the new UI, the functionality and look and feel will mainly remain the same.
    • Important SAP Notes for Risk Management (..solved the issue for our clients!)
      • 2937640 – GRC-RM dashboards are using Adobe Flash technology which comes to the end.
      • 2933196 – GRC-RM Heatmap is using Flash technology which comes to the end. …Please note that prior to V12, there were 2 versions of RM Heatmap one of which did not require Adobe Flash. This heatmap is not available in V12.
    • For Process Control v10.1, IGS solutions is released as an replacement solution of Adobe Flash, refer to Note 2986828. (Please note, 10.1 release is going out of mainstream maintenance 31.12.2020, refer to 52505)
    • Please also consider some bugfixing notes:
      • GRCCFND_A:
        • 2986849 – Set Rating in Test of control effectiveness and Issue Summary ALP (to be implemented post note 2940631)
        • 2990745 – Addition of F4 help to Signoff  Summary Analytical list page (to be implemented post note 2940631 and 2986849)
      • UIGRRMPC:
        • 2985291 – UXL – test summary ALP- filter Fix (to be implemented post note 2983759)
        • 2988931 – Survey Assessment rating pop-up issue (to be implemented post note 2983150)
        • 2985180 – Visual filter issue in Issue summary dashboard (to be implemented post note 2982595)

Some of our customers are not ready yet to fully adopt Fiori apps especially for SAP Process Control and Risk Management, therefore the decision to go ahead with IGS. Please note that SAP recommends planning the upgrade to SP11 stating that IGS for SAP GRC is a temporary solution meant for release 10.1 only but it was extended to release 12. Since release 10.1 is out of service same is most likely going to happen to IGS used for SAP GRC. (Source: SAP statements in various OSS/Incidents.)

Please refer to the IGS-enabled dashboard from SAP Risk Management, Operational Risk Management (ORM) Add-on as an example.